All the Perl that's Practical to Extract and Report

Mindbogglingly Bad Password Management

Ovid on 2009-07-14T14:49:45

Update: In case you're curious, yes I've contacted them and explained the vulnerability.

I cannot name the Web site (and if I could, I wouldn't since they desperately need to fix this security hole), but I forgot my password and requested a new one. So they sent one:

September911

Excuse me??? Sending me something which appears to be the date of an incredibly tragic incident on US soil? Shocked, I requested a new password four times. Each password matched qr/^$month_name\d{3}$/.

Anyone see a problem there?

Here are a few more interesting tidbits I've found:

  • The Web site is open to the public
  • You login with email/pass
  • The email addresses are more or less public
  • You can apparently fail as many login attempts as you want (I only tried 6 or 7 times before I gave up)

In other words, request someone's password be reset (I have the email addresses of a number of rather well-known individuals handy), wait a couple of minutes and then kick of a short mech script to cycle through the 12,000 passwords until you log in.

Look. I know most people aren't security experts, but this is nothing short of astonishing.

Even less than 12,000!

BurrMill on 2009-07-15T04:24:18

Assuming you meant your regexp to mean what it means: (999-100) * 12 = 10788. So, it's even worse than you had initially thought! :-O